Attack Ransomware is a MedusaLocker Variant
During an examination of new malware samples, our team of researchers came across a type of ransomware known as Attack.
This malware, which belongs to the MedusaLocker ransomware family, encrypts data and requests payment for its decryption. Attack ransomware exists in various forms and each version adds a different number to the ".attack" extension of encrypted files. For example, a file named "1.jpg" may be transformed into "1.jpg.attack7", etc. Once encryption is finished, the ransomware creates a message named "how_to_back_files.html" that demands a ransom. From the message, it becomes evident that the ransomware targets businesses rather than individuals.
The ransom message indicates that the attackers have penetrated the victim company's network and encrypted their files using advanced cryptographic algorithms (RSA and AES). It warns against attempting to rename or modify the encrypted files or use third-party decryption tools, as that will render the files permanently unrecoverable. Additionally, the message states that highly sensitive data was stolen from the victim's network and demands an unspecified ransom, which increases if contact is not established within 72 hours. Victims can test decryption of up to three files before meeting the ransom demand. If the ransom is not paid, the attackers threaten to publicly disclose or sell the stolen data.
The Attack Ransom Note Promises Decryption of Three Files
The full text of the Attack ransom note reads as follows:
YOUR PERSONAL ID:
YOUR COMPANY NETWORK HAS BEEN PENETRATED
All your important files have been encrypted!Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.No software available on internet can help you. We are the only ones able to
solve your problem.We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..We only seek money and our goal is not to damage your reputation or prevent
your business from running.You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.Contact us for price and get decryption software.
email:
ithelp01@decorous.cyou
ithelp01@decorous.cyou
- To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
How is Ransomware Like Attack Usually Distributed?
Ransomware such as Attack is typically distributed through various methods, including phishing emails, exploit kits, malvertising, social engineering, and remote desktop protocol (RDP) attacks. Phishing emails usually contain malicious attachments or links that, when clicked, download and execute the ransomware. Exploit kits exploit vulnerabilities in software or operating systems to deliver and install the ransomware.
Malvertising involves placing malicious code in legitimate online ads, which, when clicked, downloads and installs the ransomware. Social engineering tactics are used to trick users into downloading and running the ransomware, while RDP attacks involve brute-forcing RDP credentials to gain access to a system and deploy the ransomware. Regardless of the method used, it is important to exercise caution and adopt best practices to avoid falling victim to ransomware attacks.
